1. Integra Consult A/S Safety Assessment

2. Integra Consult A/S SAFETY ASSESSMENT Objective Objective –Demonstrate that an acceptable level of safety will be met and users have been consulted. Safety Monitoring Safety Assessment Safety Auditing Safety Promotion

3. Integra Consult A/S SAFETY ASSESSMENT Seven step approach Seven step approach –Develop complete description of the system and of the environment in which the system is to be operated –Identification of hazards –Estimation of severity of potential consequences –Estimate of likelihood of hazard occurring –Evaluation of risk –Mitigation of risk –Development of safety assessment documentation Safety Monitoring Safety Assessment Safety Auditing Safety Promotion

4. Integra Consult A/S SAFETY ASSESSMENT Safety Safety –A condition in which the risk of harm or damages is limited to an acceptable level Risk Risk –The probable rate of occurrence of a hazard causing harm and the degree of severity of the harm –Risk = Severity * likelihood –Need to define severity and likelihood –Need to define acceptability

5. Integra Consult A/S STEP 2 – HAZARD IDENTIFICATION Purpose Purpose –…to identify what could go wrong! (- or anticipate problems before they occur…) –….to identify the consequences (on safety) of the hazards A hazard is defined as any condition, event or circumstances which could induce an accident or incident (ICAO DOC 9422) The equipment (hardware and software); The operating environment; The human operators; The human machine interface (HMI); Operational procedures; Maintenance procedures; External services.

6. Integra Consult A/S STEP 3 – SEVERITY ASSESSMENT A severity is allocated each hazard consequence in accordance with the agreed severity classification scheme. A severity is allocated each hazard consequence in accordance with the agreed severity classification scheme. Example

7. Integra Consult A/S STEP 4 – LIKELIHOOD ASSESSMENT A likelihood is allocated each hazard consequence and expresses how often the consequence of a hazard is likely to occurA likelihood is allocated each hazard consequence and expresses how often the consequence of a hazard is likely to occur Example Quantitative 1*10 -3 1*10 -4 1*10 -5 1*10 -6 1*10 -7 1*10 -9

8. Integra Consult A/S STEP 5 – RISK EVALUATION Determine acceptability of identified risks Determine acceptability of identified risks –Clearly unacceptable –Clearly acceptable –May be / may be not acceptable likelihood Example

9. Integra Consult A/S STEP 6 – RISK MITIGATION Identify potential causes for a risk to occur Identify potential causes for a risk to occur Identify potential mitigation Identify potential mitigation –Remove the risk (remove the cause of the risk) –Reduce the risk Reduce severity and/or probability Reduce severity and/or probability Identify preferred mitigation approach Identify preferred mitigation approach

10. Integra Consult A/S likelihood STEP 6 – RISK MITIGATION

11. Integra Consult A/S STEP 6 – RISK MITIGATION Risk mitigation should be sought in any of the three components of a system: Risk mitigation should be sought in any of the three components of a system: –People –Procedures –Equipment The possible approaches to risk mitigation include: The possible approaches to risk mitigation include: –revision of the system (or airport) design; –modification of operational procedures; –changes to staffing arrangements; and –training of personnel to deal with the hazard.

12. Integra Consult A/S STEP 6 – RISK MITIGATION To identify causes a number of techniques may be required To identify causes a number of techniques may be required –Brainstorming sessions –Fault tree analysis - Effect tree analysis –Common cause failure identification (Single point failure) –Task, Fail-Safe & Error Tolerance Analysis –Failure Mode and Criticality Analysis –Reliability, Availability and Maintainability Analysis

13. Integra Consult A/S STEP 7 - SAFETY ASSESSMENT DOCUMENTATION The purpose: The purpose: –To provide a permanent record of the final result of the safety assessment –To provide the arguments and evidence demonstrating that the risks associated with the implementation of the proposed system or change: have been eliminated, or have been eliminated, or have been adequately controlled and reduced to a tolerable level. have been adequately controlled and reduced to a tolerable level.

14. Integra Consult A/S DIFFICULTIES – SAFETY ASSESSMENT General General –Complex, resource-demanding activity Target Levels of Safety (Severity and Likelihood) Target Levels of Safety (Severity and Likelihood) –Complexity –No guidelines or recommendation – in most cases not even statistics –No guidelines to apportioning Safety Targets to lower levels –No guidelines to who does what (Regulator Provider Supplier)

15. Integra Consult A/S DIFFICULTIES – SAFETY ASSESSMENT Risk Mitigation Risk Mitigation –Very demanding concepts (software assurance levels, procedure assurance levels) –Very demanding activities for risk mitigation –Analyses required beyond reach for many organisation

16. Integra Consult A/S RECOMMENDATIONS Start with low level of ambition Start with low level of ambition –Even simple Safety Assessment provides quite efficient risk mitigation –Introduce more advanced features once the simple version works –Start with quantitative likelihood classification while data are collected to establish qualitative figures Make sure assumptions are well-defined and traced Make sure assumptions are well-defined and traced

17. Integra Consult A/S RECOMMENDATIONS Dont forget to design a follow-up system for (ICAO 2.26.5) Dont forget to design a follow-up system for (ICAO 2.26.5) –Hazards (likelihood for different causes) –Assumptions, e.g.: Capacity figures Capacity figures Reliability figures Reliability figures –Should be extracted from the reporting system

18. Integra Consult A/S SUPPORTING SLIDES

19. Integra Consult A/S Target Level of Safety Severity Class StateMaximum tolerable probability (of ATM- direct contribution) 1Accident1,55 10 -8 per Flight hours (equal to 2,31 10 -8 per Flight) 2Serious IncidentTo be included in future revision (once enough safety data has been collected) 3Major IncidentTo be included in future revision (once enough safety data has been collected) 4Significant IncidentTo be included in future revision (once enough safety data has been collected) 5No immediate effect To be included in future revision (once enough safety data has been collected) Ref.: ESARR 4, Appendix A

20. Integra Consult A/S Target Level of Safety ESARR 4 notes that: ESARR 4 notes that: – In order to deal with specific constituent parts of the ATM system (sub-systems), the table will have to be refined so that it adequately reflect the operational environment of the sub-system under consideration (e.g. interfaces with other systems, phases of flight, classes of airspace).

21. Integra Consult A/S This will necessitate:- This will necessitate:- the redefinition of the severity categories such that they are meaningful in the context of the sub- system under consideration, and the redefinition of the severity categories such that they are meaningful in the context of the sub- system under consideration, and the accommodation of mitigations in other sub- systems for events in the sub-system under consideration which may lead to a hazard. the accommodation of mitigations in other sub- systems for events in the sub-system under consideration which may lead to a hazard. No guidance is given here (in the ESARR) as to how the refinement should be achieved. No guidance is given here (in the ESARR) as to how the refinement should be achieved.

22. Integra Consult A/S Target Level of Safety ESARR figures only refers to an overall safety performance of ATM at ECAC and national level and is not directly applicable to the classification of individual hazards. ESARR figures only refers to an overall safety performance of ATM at ECAC and national level and is not directly applicable to the classification of individual hazards. To achieve this a method of apportionment of the overall probability to the constituent parts of the ATM system may need to be developed. To achieve this a method of apportionment of the overall probability to the constituent parts of the ATM system may need to be developed. This apportionment may be done per phase of flight and/or per accident types. This apportionment may be done per phase of flight and/or per accident types.

23. Integra Consult A/S Target Level of Safety The National Regulatory Authority will have to establish National Target Levels of Safety based on: The National Regulatory Authority will have to establish National Target Levels of Safety based on: –National statistics (should as minimum be as safe as today) Difficulties (data for all severity categories are not collected currently) Difficulties (data for all severity categories are not collected currently) –Benchmarking other countries to which we would like to be compared and where: Statistics are available Statistics are available Targets have been set Targets have been set

24. Integra Consult A/S Target Level of Safety

25. Integra Consult A/S Target Level of Safety METNAV/Enr NAV/Ter m GroundTWRAPPACC Safety factor for Accidents (1,55 10 -8 per Flight hour) Mid-air collision ÷ Controlled flight into terrain ÷ Accident on ground with fatalities ÷÷÷ …… Safety Factors for Serious Incidents Separation minima infringement (less than 50%) ÷ Runway incursion with avoiding action ÷÷÷ ……